Vary on forceHTTPS cookie